github-action: provenance generation

.github/workflows/release-main.yml

@@ -5,9 +5,11 @@ on:
     branches: [ "main" ]
 
 permissions:
-    contents: write
-    issues: write
-    packages: write
+  attestations: write
+  contents: write
+  id-token: write
+  issues: write
+  packages: write
 
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
@@ -37,7 +39,12 @@ jobs:
         secrets: |
           secret/apm-team/ci/elastic-observability-feedz.io apiKey | REPO_API_KEY ;
           secret/apm-team/ci/elastic-observability-feedz.io url | REPO_API_URL
-
+
+    - name: generate build provenance
+      uses: github-early-access/generate-build-provenance@main
+      with:
+        subject-path: "${{ github.workspace }}/build/output/_packages/*.nupkg"
+
     # Github packages requires authentication, this is likely going away in the future so for now we publish to feedz.io
     - name: publish canary packages to feedz.io
       run: dotnet nuget push 'build/output/_packages/*.nupkg' -k ${REPO_API_KEY} -s ${REPO_API_URL} --skip-duplicate --no-symbols

.github/workflows/release.yml

@@ -17,14 +17,23 @@ env:
 jobs:
   release:
     runs-on: ubuntu-latest
-
+    env:
+      PREFIX_APM_AGENT: "build/output/ElasticApmAgent_"
+      PREFIX_APM_PROFILER: "build/output/elastic_apm_profiler_"
+      SUFFIX_APM_AGENT: ".zip"
+      SUFFIX_APM_PROFILER: "-linux-x64.zip"
+      DOCKER_IMAGE: "docker.elastic.co/observability/apm-agent-dotnet"
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
     steps:
     - uses: actions/checkout@v4
     - name: Bootstrap Action Workspace
       id: bootstrap
       uses: ./.github/workflows/bootstrap
       with:
-          rust: 'true'
+        rust: 'true'
 
     - name: Package
       run: ./build.sh pack
@@ -51,23 +60,43 @@ jobs:
         roleId: ${{ secrets.VAULT_ROLE_ID }}
         secretId: ${{ secrets.VAULT_SECRET_ID }}
 
-    - name: Build Profiler Docker Image
-      continue-on-error: true #continue for now until we see it working in action
-      run: |
-        docker build . -t docker.elastic.co/observability/apm-agent-dotnet:${{ steps.bootstrap.outputs.agent-version }} \
-            --build-arg AGENT_ZIP_FILE=build/output/elastic_apm_profiler_${{ steps.bootstrap.outputs.agent-version }}-linux-x64.zip
-
-    - name: Push Profiler Docker Image
-      continue-on-error: true #continue for now until we see it working in action
-      run: |
-        for i in $(seq 1 3); do [ $i -gt 1 ] && sleep 15; docker push docker.elastic.co/observability/apm-agent-dotnet:${{ steps.bootstrap.outputs.agent-version }} && s=0 && break || s=$?; done; (exit $s)
-
+    - name: Build and Push Profiler Docker Image
+      id: docker-push
+      continue-on-error: true # continue for now until we see it working in action
+      uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0  # v5.3.0
+      with:
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        context: .
+        push: true
+        tags: |
+          ${{ env.DOCKER_IMAGE }}:${{ steps.bootstrap.outputs.agent-version }}
+        build-args: |
+          AGENT_ZIP_FILE=${{ env.PREFIX_APM_PROFILER }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_PROFILER }}
+
+    - name: Attest image
+      uses: github-early-access/generate-build-provenance@main
+      with:
+        subject-name: ${{ env.DOCKER_IMAGE }}
+        subject-digest: ${{ steps.docker-push.outputs.digest }}
+        push-to-registry: true
+
+    - name: generate build provenance (APM Agent)
+      uses: github-early-access/generate-build-provenance@main
+      with:
+        subject-path: "${{ github.workspace }}/${{ env.PREFIX_APM_AGENT }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_AGENT }}"
+
+    - name: generate build provenance (APM Profiler)
+      uses: github-early-access/generate-build-provenance@main
+      with:
+        subject-path: "${{ github.workspace }}/${{ env.PREFIX_APM_PROFILER }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_PROFILER }}"
+
     - name: Attach Profiler And Startup Hooks
       continue-on-error: true #continue for now until we see it working in action
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
-        gh release upload ${{ github.ref_name }} "build/output/ElasticApmAgent_${{ steps.bootstrap.outputs.agent-version }}.zip" "build/output/elastic_apm_profiler_${{ steps.bootstrap.outputs.agent-version }}-linux-x64.zip"
+        gh release upload ${{ github.ref_name }} "${{ env.PREFIX_APM_AGENT }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_AGENT }}" "${{ env.PREFIX_APM_PROFILER }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_PROFILER }}"
 
     - if: ${{ success() }}
       uses: elastic/apm-pipeline-library/.github/actions/slack-message@current
@@ -98,7 +127,13 @@ jobs:
     outputs:
       agent-version: ${{ steps.bootstrap.outputs.agent-version }}
       major-version: ${{ steps.bootstrap.outputs.major-version }}
-
+    env:
+      PREFIX_ZIP_FILE: "build/output/elastic_apm_profiler_"
+      SUFFIX_ZIP_FILE: "-win-x64.zip"
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - name: Bootstrap Action Workspace
@@ -110,12 +145,17 @@ jobs:
       - name: Build profiler
         run: ./build.bat profiler-zip
 
+      - name: generate build provenance (APM Profiler)
+        uses: github-early-access/generate-build-provenance@main
+        with:
+          subject-path: "${{ github.workspace }}/${{ env.PREFIX_ZIP_FILE }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_ZIP_FILE }}"
+
       - name: Attach Profiler
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         continue-on-error: true #continue for now until we see it working in action
         run: |
-          gh release upload ${{ github.ref_name }} "build/output/elastic_apm_profiler_${{ steps.bootstrap.outputs.agent-version }}-win-x64.zip"
+          gh release upload ${{ github.ref_name }} "${{ env.PREFIX_ZIP_FILE }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_ZIP_FILE }}"
 
   post-release:
     needs: [ 'release-windows']